@openwop/spec-artifacts 2.0.4 → 2.0.6

package/spec/v2/core/conformance.md

@@ -0,0 +1,66 @@
+# Conformance
+
+> **Status: Draft · v2.0.0-rc (2026-09-03) · RFC 0168.**
+
+## Why this exists
+
+v1 could say a host passed and could not say what it witnessed: test ids were derived from titles, the witness class was recorded on extensions but not requirements, nine test-seam operations sat in the canonical API, and the certification bundle had an open root and no signature. This document is the v2 evidence contract: how a requirement is asserted, how every requirement declares what can witness it, how the seams are mounted, what the suite ships, and what a bundle proves. Profiles are in overview.md; the capability vocabulary the suite gates on is capabilities.md.
+
+## Requirement ids
+
+`expect(x, req('openwop.<area>.<slug>', '<doc> §<section>', '<requirement>'))` is the only assertion form. A scenario assertion without a requirement id MUST fail the suite's lint. Ids are minted in `conformance/requirements.json`; every test declares its id explicitly. A title reword without a corresponding `requirement-aliases.json` row MUST fail CI, because published bundles cite ids and an orphaned id orphans every bundle that cited it.
+
+The ledger records per `it`, and a bundle's `results.requirements[]` is the per-assertion list. A post-assertion soft-skip MUST record `skipped` for every id not reached and MUST NOT record `pass`.
+
+## Witness class
+
+Every family in `spec/v2/declaration.json`, every requirement in `conformance/requirements.json`, and every row of `SECURITY/invariants.yaml` MUST carry `witness` from the closed set:
+
+| Class | Meaning |
+| --- | --- |
+| `witnessable-unaided` | the suite observes it on any host with no advertisement |
+| `witnessable-gated` | observed when the host advertises the gating capability |
+| `seam-gated` | observed only through the seams profile |
+| `claims-check` | the host's own claim is checked for shape, not behavior |
+| `negative-existence` | the suite asserts a thing is absent |
+| `unwitnessable` | no observation path exists; `rationale` REQUIRED |
+
+A protocol-tier invariant marked `unwitnessable` MUST fail the corpus gate. `tests: []` is expressible only as `unwitnessable`. A bundle disposition `blocked` does not exist as a witness class: what v1 called blocked is `seam-gated` or `unwitnessable`.
+
+The six v1 certification admissions map to one class each: the shape-versus-behavior dual grade is `witnessable-gated` on the behavioral leg, never two grades; "blocked as unobservable" is `seam-gated` or `unwitnessable`; install-time-only extension opacity is `claims-check`; corpus-structural legs run in the spec repo's CI and have no host class; gRPC end-to-end is `unwitnessable` (interop.md); a negative-existence claim is `negative-existence`.
+
+A MUST whose only witness is `seam-gated` MUST either mint a normative observation path before the cut or be demoted to SHOULD. The seam count in `docs/witness-baseline.json` is a ratchet and MUST NOT rise.
+
+## The seams profile
+
+Test seams are the profile `openwop-conformance-seams-v2` (`spec/v2/profiles.json`), described by `api/seams-v2.yaml` with schemas under `schemas/v2/seams/`, in the path space `/conformance/seams/…`. The seam schemas `$ref` the canonical error and event schemas with no tolerance path. A host that mounts the seams MUST advertise the profile in `profiles[]`; a `testSeams` capability flag does not exist and MUST NOT be advertised. `api/v2/openapi.yaml` and `spec/v2/path-manifest.json` MUST contain no seam or sample-host operation; an SDK generated from the canonical document has no seam method. The profile is versioned with the suite (`seams-v2` for 2.x).
+
+## Two products, two ledgers
+
+Corpus-coherence checks run in the spec repo's CI (`scripts/check-spec-coherence.mjs`) and MUST NOT appear in a host bundle; the bundle schema forbids their ids. `--offline` is a declared property of a scenario, not a runtime discovery.
+
+`@openwop/openwop-conformance@2.0.0` ships `dist`, `fixtures`, and `vectors` only. The corpus — `api/`, `schemas/`, the `spec/v2/*.json` registries, `CORPUS-STAMP.json` — is `@openwop/spec-artifacts@2.0.0`, an exact-pinned peer dependency the suite MUST digest-check at start and MUST refuse to run against on a mismatch. The suite is one package: `--target-major 1|2` selects the target (default: the host's `preferredVersion`), scenario ids share one namespace across majors, and the 1.x target is removed at v1 end-of-support.
+
+## Bundle v3
+
+A certification bundle validates against `schemas/v2/certification-bundle.schema.json`: closed root, `bundleVersion: "3"`.
+
+| Field | Rule |
+| --- | --- |
+| `suite` | `name`, `version`, `targetMajor`, `specArtifactsVersion` REQUIRED |
+| `host` | `name`, `version`, `build.{kind, id}` REQUIRED; `kind` is `image-digest`, `commit`, or `artifact-sha256` |
+| `discovery` | `url`, `sha256`, `protocolVersions`, `preferredVersion` REQUIRED |
+| `claimedProfiles[]` | `id`, `evidenceTier` (`self` \| `steward` \| `independent`), `witnessCount`, `certified` REQUIRED |
+| `results` | `totals` and the per-requirement list REQUIRED |
+| `witnessSha256` | REQUIRED; covers the reporter record |
+| `assertionCount` | REQUIRED, ≥ 1 |
+| `detail.nonPass[]` | REQUIRED when any total other than `executedPass` is non-zero |
+| `signature` | REQUIRED |
+
+`signature` is an Ed25519 attestation over the canonical JSON of `{ witnessSha256, host.build, suite.version, discovery.sha256 }`; `over` MUST list exactly those four members. A host that signs bundles MUST publish the corresponding public keys as `signingKeys[]` in its discovery document, and `signature.keyId` MUST name one of them. A verifier MUST resolve `keyId` there — in the discovery document of the host the bundle is *about* — and MUST verify the attestation under the published key.
+
+A signature that cannot be resolved to a published key attests **integrity only**: it proves the bundle was not altered after signing, and proves nothing about who signed it, because a signer can mint a keypair and a key id at will. Such a bundle MUST NOT be read as attributable evidence, and a gate MUST distinguish three outcomes that a presence check collapses into one — *no discovery document was read*, *read and the key is not published*, and *the attestation does not verify*. A retired key MUST stay listed, because removing it silently invalidates every bundle it already signed. `evidenceTier: independent` MUST carry a `verifierKeyId` distinct from the host's signing key; the verifier MUST refuse, not warn, on a missing or self-signed independent claim. A bundle with `totals.blocked > 0` does not certify. A profile that carries an operator relaxation (`host.relaxations[]`) cannot certify. v1 and v2 bundles are never upgraded to v3; a bundle is evidence at its own version.
+
+## Corpus-gate evidence
+
+An RFC whose acceptance criteria are corpus gates rather than host scenarios records the evidence label **corpus gate — no host tier** in its `Updated` line; the accepted-predicate check reads `(corpus)` rows from `evidence/corpus-ledger.json` for such an RFC and MUST NOT require a host bundle for it.

package/spec/v2/core/connection-packs.md

@@ -0,0 +1,32 @@
+# Connection Packs
+
+> **Status: Draft · v2.0.0-rc (2026-09-03) · RFC 0177, RFC 0095.**
+
+## Why this exists
+
+A connection pack is a signed provider definition — the endpoints, scope catalog, and reach a connector's `auth.provider` string resolves against. v1 let two definitions claim one `provider.id` and picked between them silently by version. v2 makes the id unique per host and makes a collision fail closed. The manifest is `schemas/v2/connection-pack-manifest.schema.json`; installation and signing follow packs.md.
+
+## Provider identity
+
+A `provider.id` MUST be unique per host. Built-in provider definitions are the host's own pack for every rule in this document.
+
+| Situation | Host behavior |
+| --- | --- |
+| Exactly one definition of bare id `P` | `P` resolves to it |
+| An installed pack and a built-in both define `P` | the later registration MUST be refused with `connection_provider_conflict` |
+| Two installed packs both define `P` | the later registration MUST be refused with `connection_provider_conflict` |
+| No definition of `P` | the dependent connector or pack MUST be refused with `connection_provider_unresolved` |
+
+A host MUST NOT choose between two claimants by comparing versions.
+
+## The qualified form
+
+A connector MAY name a provider by its qualified form `<packName>#<id>`. A qualified reference resolves only to the named pack's definition. A bare id resolves only when exactly one definition exists on the host.
+
+## Resolution
+
+A host advertising `connections.packsSupported` MUST resolve a connector's `auth: { type: "oauth2", provider: P }` (and any `host.oauth` invocation for `P`) against the definition selected above to obtain its endpoints and scope catalog. An unresolvable provider MUST be refused when the dependent connector or pack is registered. On a publish-path host, resolution MUST run after the idempotency short-circuit: a byte-identical re-publish of an installed pack MUST succeed even when resolution inputs have since changed.
+
+## Errors
+
+Both codes are in `spec/v2/errors.json`: `connection_provider_conflict` (two claimants for one bare id) and `connection_provider_unresolved` (no definition for the referenced id).

package/spec/v2/core/errors.md

@@ -0,0 +1,131 @@
+# Errors
+
+> **Status: Draft · v2.0.0-rc (2026-09-03) · RFC 0171 §B.**
+
+## Why this exists
+
+Every error a v2 host returns is a row in one registry. A client routes on `error`, never on `message`, and a code that is not registered is not a protocol error. The registry is the single source for the envelope schema, the HTTP status, and retriability.
+
+## The registry
+
+`spec/v2/errors.json` holds one row per code: `{ code, httpStatus, retriable, details, since, deprecated? }` plus the provenance fields `statusSource` and `source`. It registers **96** codes. `schemas/v2/error-envelope.schema.json` is GENERATED from it and MUST NOT be edited by hand.
+
+A host MUST return a registered code, or a vendor code, in every error response. A vendor code MUST match `^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9_]*$` with its first segment an org registered in `spec/v2/declaration.json`; `openwop.` is reserved. The registry grows by the closed-enum rule in overview.md §0: a producer MUST NOT emit an unregistered member, and a consumer MUST accept an unknown registered member and MUST NOT act on it.
+
+## The envelope
+
+Every error response body MUST be `{ error, message, details? }` and nothing else (`additionalProperties: false`). `error` is the registered code or a vendor code; `message` is a non-empty string; `details` is an object whose shape is the row's `details` schema. A row whose `details` is `null` accepts any object; when a row registers a schema, the generated envelope becomes a `oneOf` discriminated on `error`. Contextual data (conflict refs, trace ids, validation paths) MUST live under `details`, never at a new top level. The same envelope is the per-id `error` of `bulkCancelRuns` (runs.md). When present, `details.correlationId` MUST be a non-empty string.
+
+`x-openwop-http-status` and `x-openwop-retriable` in the generated schema mirror the registry; a host MUST answer with the registered status.
+
+## Retry timing
+
+Retry timing lives in the `Retry-After` header only. `details.retryAfter`, `details.retryAfterMs` and `details.retryAfterSeconds` are not part of v2 and a host MUST NOT emit them. A `429 rate_limited` response MUST set `Retry-After`. The retriable rows are `residency_unavailable`, `rate_limited`, `internal_error`, `pack_registry_unreachable`, `runner_unavailable`.
+
+## One code per state
+
+An interrupt has one code per state: a token or run-scoped resolve against an interrupt that is already resolved, or whose run is cancelled or completed, MUST return `409 interrupt_already_resolved`; a signed token past its `expiresAt` MUST return `410 interrupt_expired`; a token whose `alg` or `kid` the host does not accept MUST return `401 interrupt_token_invalid` (see interrupt.md, identity.md). The idempotency mismatch code is `idempotency_key_mismatch` only (idempotency.md).
+
+## Codes by HTTP status
+
+Generated from `spec/v2/errors.json` (97 codes; `retriable` and `statusSource` are in the registry).
+
+Code | Status
+--- | ---
+`connection_provider_unresolved` | 400
+`connector_action_unresolved` | 400
+`credential_scope_unsupported` | 400
+`delegation_chain_cyclic` | 400
+`delegation_chain_too_long` | 400
+`idempotency_key_invalid` | 400
+`interop_version_unsupported` | 400
+`oauth_provider_unsupported` | 400
+`oauth_scope_unsupported` | 400
+`pack_dependency_cycle` | 400
+`pack_engine_unsupported` | 400
+`pack_integrity_failure` | 400
+`pack_kind_invalid` | 400
+`pack_lockfile_incomplete` | 400
+`pack_peer_dependency_missing` | 400
+`pack_peer_dependency_undefined` | 400
+`pack_signature_invalid` | 400
+`pack_validation_failed` | 400
+`protocol_version_mismatch` | 400
+`schedule_horizon_exceeded` | 400
+`sub_chain_cycle` | 400
+`sub_chain_depth_exceeded` | 400
+`unsupported_stream_mode` | 400
+`until_in_past` | 400
+`validation_error` | 400
+`webhook_url_rejected` | 400
+`audience_mismatch` | 401
+`connector_auth_expired` | 401
+`credential_revoked` | 401
+`delegation_expired` | 401
+`identity_unresolvable` | 401
+`identity_unverified` | 401
+`interrupt_token_invalid` | 401
+`key_revoked` | 401
+`sender_constraint_missing` | 401
+`unauthenticated` | 401
+`credential_forbidden` | 403
+`delegation_scope_amplified` | 403
+`forbidden` | 403
+`force_engine_version_forbidden` | 403
+`id_tenant_mismatch` | 403
+`mock_provider_forbidden` | 403
+`pack_namespace_unauthorized` | 403
+`run_forbidden` | 403
+`sandbox_capability_denied` | 403
+`sandbox_escape_attempt` | 403
+`workspace_membership_required` | 403
+`credential_not_found` | 404
+`interrupt_not_found` | 404
+`not_found` | 404
+`pack_version_not_found` | 404
+`replay_source_missing` | 404
+`signature_not_available` | 404
+`protocol_version_unsupported` | 406
+`connection_provider_conflict` | 409
+`envelope_correlation_conflict` | 409
+`idempotency_in_flight` | 409
+`idempotency_key_mismatch` | 409
+`interrupt_already_resolved` | 409
+`pack_dependency_conflict` | 409
+`pack_integrity_mismatch` | 409
+`replay_diverged_at_refusal` | 409
+`replay_memory_snapshot_unavailable` | 409
+`run_already_active` | 409
+`run_terminal` | 409
+`run_state_conflict` | 409
+`version_conflict` | 409
+`workspace_conflict` | 409
+`interrupt_cancelled` | 410
+`interrupt_expired` | 410
+`workspace_too_large` | 413
+`payload_too_large` | 413
+`unsupported_media_type` | 415
+`capability_not_provided` | 422
+`capability_required` | 422
+`credential_required` | 422
+`envelope_invalid` | 422
+`envelope_refusal` | 422
+`fork_point_invalid` | 422
+`envelope_truncation_unrecoverable` | 422
+`loop_limit_exceeded` | 422
+`mcp_mrtr_rounds_exceeded` | 422
+`pack_runtime_requirement_unmet` | 422
+`recursion_limit_exceeded` | 422
+`residency_unavailable` | 422
+`run_timeout` | 422
+`sandbox_memory_exceeded` | 422
+`sandbox_timeout` | 422
+`token_budget_exceeded` | 422
+`client_version_unsupported` | 426
+`rate_limited` | 429
+`event_type_unmapped` | 500
+`internal_error` | 500
+`pack_load_failure` | 500
+`credential_unavailable` | 501
+`pack_registry_unreachable` | 503
+`runner_unavailable` | 503

package/spec/v2/core/events.md

@@ -0,0 +1,109 @@
+# Events
+
+> **Status: Draft · v2.0.0-rc (2026-09-03) · RFC 0171 §A, §E; RFC 0176 §A.**
+
+## Why this exists
+
+A run is its append-only event log; every snapshot, stream, poll, fork and diff is a projection of it. v2 has one event envelope, one closed type registry with one naming rule, one payload registry, one ordering field, one events channel and one poll cursor, so that a typo is a validation failure and not a silently ignored event.
+
+## The envelope
+
+`schemas/v2/run-event.schema.json` (`RunEventDoc`) is closed. `eventId`, `runId`, `type`, `payload`, `timestamp`, `sequence` and `schemaVersion` are REQUIRED; `nodeId`, `engineVersion` and `causationId` are OPTIONAL. Every id field `$ref`s its grammar in `schemas/v2/ids.schema.json` (identity.md).
+
+| Field | Rule |
+| --- | --- |
+| `sequence` | The one ordering field: integer ≥ 0, first event `0`, strictly increasing per run. Persisted logs are never renumbered. |
+| `schemaVersion` | Per-event schema version, integer ≥ 1, first-class (RFC 0172 §B axis 5). |
+| `engineVersion` | Integer ≥ 0 everywhere (RFC 0172 §B axis 3). |
+| `eventId` | Host-minted, opaque; consumers MUST treat it as a string. |
+| `causationId` | The `eventId`, or AI-envelope `correlationId`, that caused this event. |
+| `timestamp` | ISO 8601. |
+
+A consumer MUST NOT throw on an event whose `type` it does not know; it folds what it understands and ignores the rest.
+
+## Types
+
+`type` is `oneOf` a closed enum of registered protocol types and a vendor pattern. The enum is GENERATED from `spec/v2/event-codemap.json` (117 rows, every row `decided`) and MUST NOT be edited by hand. The vendor branch is exactly:
+
+```text
+^(?!openwop\.)[a-z][a-z0-9]*(-[a-z0-9]+)*\.[a-z][a-z0-9]*(-[a-z0-9]+)*(\.[a-z][a-z0-9]*(-[a-z0-9]+)*)?$
+```
+
+| Rule | Requirement |
+| --- | --- |
+| Naming | A protocol type is `domain.verb-ed`: kebab-case, exactly two segments, past tense for a transition (`run.started`, `node.suspend-failed`, `run.resume-started`). `domain.noun` is permitted only for an emitted artifact (`output.chunk`, `provider.usage`, `channel.presence`, `agent.handoff`, `envelope.refusal`, `agent.reasoning-delta`, `voice.synthesis-chunk`, `voice.endpoint-candidate`); each exception is recorded in the codemap and checked by the corpus gate. |
+| Reserved prefix | `openwop.` is the only reserved prefix. `core.`, `community.`, `vendor.`, `private.` and `local.` are pack namespaces, not event namespaces, and a type under them is invalid. |
+| Vendor events | A vendor type's first segment MUST be an org registered in the `extensions` object of `spec/v2/declaration.json` — the ORG REGISTRY, not the `extensions` metadata key a host publishes in its own discovery payload; an unregistered org fails validation. An org named in `reservedOrgs` is forbidden, never registered, and `extensionsKeyPattern` is the shape a vendor type must have, not a permission to use it. The registry is normally small: `example` is held by the protocol for documentation and conformance and is never assignable to a vendor. |
+| Growth | The registry grows by the closed-enum rule in overview.md §0: a producer MUST NOT emit an unregistered protocol type; a consumer MUST accept an unknown registered member and MUST NOT act on it. |
+
+## Payloads
+
+`schemas/v2/run-event-payloads.schema.json` holds one `$defs` entry per payload, every entry `additionalProperties: false`, and `_typeIndex`: the NORMATIVE map from v2 type to `$defs` key, GENERATED from `spec/v2/event-codemap.json`. A host MUST emit a payload that validates against the entry `_typeIndex` names for its `type`. Sub-typing is `$ref` composition, never duplication: `approval.*` and `clarification.*` resolve to `interruptRequested` / `interruptResolved` (interrupt.md); `lease.acquired`, `lease.renewed` and `lease.lost` share `leaseLifecycle`.
+
+The CloudEvents mapping and the webhook delivery envelope are GENERATED from the same definition (one source, three renderings): the event's `type`, `eventId`, `sequence` and `payload` are byte-identical across the run stream, a CloudEvents rendering and a webhook delivery.
+
+`run.started` carries `owner { tenant, workspace?, subject }`, the same closed block as `RunSnapshot.owner` with `subject` REQUIRED (runs.md, identity.md). `run.cancelled` carries `reason`, `cancelledBy`, `durationMs` and `parentRunId`. `run.completed` MUST carry `outputs` as an object — an empty object is a valid value; an absent key is not. A client cannot tell "no outputs" from "outputs not rendered" when the key is missing, and until 2026-09-04 no schema in either major required it: v1 named the property, required nothing and left the object open, so a host emitted the singular `output` for its whole life and validated every time. Closing the object in v2 caught the extra key; only this sentence and its witness (`v2-run-completed-outputs`) catch an absent one.
+
+## AI envelopes: E1–E5
+
+`schemas/v2/ai-envelope.schema.json` is the shape an LLM emits; the engine records its acceptance as one or more `RunEventDoc`s. In v2 `correlationId` and `meta.source` are REQUIRED on every envelope, and an engine MUST reject an envelope that omits either; nothing is synthesized. An envelope kind MUST be namespaced under the same `<org>.` rule as events, universal kinds excepted.
+
+| Gap | Contract |
+| --- | --- |
+| E1 partial reassembly | Every chunk of one partial emission carries the same `correlationId`; the events that record them are ordered by `sequence`; the emission is complete at the first recorded chunk with `partial: false`. A consumer MAY render progressively but MUST NOT enable any action before that event. |
+| E2 multi-turn correlation | Each turn is an envelope with its own `correlationId`; every event it produces carries `causationId = correlationId`. A re-emission with a `correlationId` already recorded in the run MUST return the cached outcome and MUST NOT emit new events. |
+| E3 vendor kinds | The registry of vendor kinds is `spec/v2/declaration.json`; a kind whose org is not registered is invalid. |
+| E4 sub-typing | `$ref` composition, as in the payload registry above. |
+| E5 refusal × retry | `configurable.ai.maxRefusals` (runs.md) is the ceiling on `envelope.refusal` events a run records. A host MUST NOT retry the emission that produced a refusal. |
+
+Worked example (E5), `maxRefusals: 2`:
+
+```text
+seq 7  envelope.refusal   nodeId n1  (refusal 1; the run's retry policy re-dispatches n1)
+seq 9  envelope.refusal   nodeId n1  (refusal 2 = ceiling)
+seq 10 node.failed        error.code envelope_refusal; n1 is not re-dispatched
+```
+
+## The events channel
+
+`api/v2/asyncapi.yaml` declares one channel, `runEvents`, at `/runs/{runId}/events`, and `api/v2/openapi.yaml` declares the same path (`streamRunEvents`); the two MUST resolve to the same absolute path (RFC 0172 §C.2). The `streamMode` query parameter is one pattern, not four enums:
+
+```text
+^(values|(updates|messages|debug)(,(updates|messages|debug))*)$
+```
+
+The default is `updates`. A host MUST implement `updates` and SHOULD implement all four. A value outside the pattern, or a mode the host does not implement, MUST return `400 unsupported_stream_mode` with `details.supported` listing each individual mode the host serves; combinations are not listed. Validation MUST run before any content negotiation.
+
+| Mode | Emits | Combines |
+| --- | --- | --- |
+| `updates` | Run transitions, terminal node transitions, suspensions, `node.dispatched`, interrupt events, `artifact.created`, `eval.*`, `deployment.*`, `workspace.updated`; each payload is a delta | yes |
+| `values` | One synthesized `state.snapshot` (`schemas/v2/run-snapshot.schema.json`) after each `updates`-tier transition | never |
+| `messages` | `ai.message.chunk` (`outputChunk` payload) from streaming AI nodes only; a host MUST populate a Tier 1 `meta` slot whenever it has the data | yes |
+| `debug` | Every event in the log, including `log.appended`, `variable.changed`, `version.pinned`, `lease.*`, `node.retried` and every vendor event | yes |
+
+Vendor events appear in `debug` only. In a mixed mode the host emits the union of the filters in log order and MUST NOT reorder; each frame SHOULD carry `event:` naming the mode that admitted it, and a consumer MUST tolerate an event admitted by more than one mode.
+
+### SSE frames
+
+Each frame carries `id:`, `event:` and `data:`: `id:` is the `sequence`, `event:` is the v2 `type` (single mode), `data:` is the `RunEventDoc`. Two frame names are not types and are not in the `type` enum: `state.snapshot` (the `values` frame, whose `data:` is a `RunSnapshot`) and `batch` (the `bufferMs` frame, whose `data:` is an array of `RunEventDoc`). A host MUST set `Content-Type: text/event-stream`, MUST emit a keep-alive comment at least every 30 seconds, and MUST close the connection after the run's terminal event (`run.completed`, `run.failed`, `run.cancelled`).
+
+`Last-Event-ID` resumes every mode: the host MUST look up the event with that sequence, MUST begin at the next sequence, and MUST NOT re-emit the resumption point. In `values` mode resumption MUST emit a `state.snapshot` first. With `bufferMs` (0..5000) the host accumulates events into one `event: batch` frame whose `data:` is an array of `RunEventDoc`; it MUST flush on a terminal event, on `node.suspended`, and on close; the batch's `id:` SHOULD be its highest `sequence` and `Last-Event-ID` MUST honor that id. A consumer MUST tolerate both a one-element batch and an unbatched frame. A host MUST NOT limit subscribers per run except for resource protection, and then MUST answer `429 rate_limited` with `Retry-After` rather than drop silently.
+
+### Host events
+
+`hostEvents` carries the heartbeat messages (`schemas/v2/heartbeat-evaluated.schema.json`, `schemas/v2/heartbeat-state-changed.schema.json`) at `/host/events` (`streamHostEvents`), the documented default; a host MAY declare another address under `heartbeat.deliveryChannel` (capabilities.md). The channel is content-free of run data. There is no channel without an address.
+
+## Poll
+
+`GET /runs/{runId}/events/poll` (`pollRunEvents`) is the long-poll fallback.
+
+| Parameter | Rule |
+| --- | --- |
+| `afterSequence` | Integer ≥ 0; the response carries events with `sequence > afterSequence`. Omission means "from the first event" (sequence 0). `lastSequence` and `since` are not parameters. |
+| `timeout` | Seconds to wait for new events, 1..60, default 30. |
+
+The response is `{ runId, events, lastSequence, status, isTerminal }` (closed): `lastSequence` is the highest sequence in the log at the time of the response, `-1` when the log is empty, and has no other meaning; `status` is the snapshot status; `isTerminal` is whether the run is terminal. A cursor past the end of the log MUST return `200` with an empty `events` array. The shape is declared here and generated into `api/v2/openapi.yaml` from one definition.
+
+## Era-2 logs
+
+A run whose `eventLogSchemaVersion` is `2` was written by a v1 host. Every reader (poll, stream, fork, diff, debug bundle) MUST translate each event through `spec/v2/event-codemap.json` at the storage boundary: `type` is mapped, the payload is projected, `sequence` (including `0`), `eventId`, `timestamp` and `causationId` pass through. A type the codemap does not name and that carries no vendor org MUST fail the read with `500 event_type_unmapped`. A host MUST NOT carry a private mapping and MUST NOT rewrite era-2 rows in place. Fork and replay over an era-2 parent are in replay.md.

package/spec/v2/core/form-content-packs.md

@@ -0,0 +1,32 @@
+# Form Content Packs
+
+> **Status: Draft · v2.0.0-rc (2026-09-03) · RFC 0177, RFC 0137.**
+
+## Why this exists
+
+A form-content pack ships declarative form templates a host renders in its own chrome. v1 templates had no conditional visibility, no localization, and no validation beyond `required` and `format`. v2 adds all three by reusing constructs the corpus already defines. The manifest is `schemas/v2/form-content-pack-manifest.schema.json`; installation and signing follow packs.md.
+
+## Conditional visibility
+
+A field MAY carry `when: <EdgeCondition>`. The grammar is the `WorkflowEdge.condition` object `{ type, left, right }` of `schemas/v2/workflow-definition.schema.json`, with the operator set of workflow-chain-packs.md §"Edge conditions": `type` is one of `expression`, `equals`, `notEquals`, `contains`, `regex`, `truthy`, `falsy`; `truthy` and `falsy` take `left` only. A host MUST evaluate `when` with its edge-condition semantics and MUST NOT accept any other expression language for visibility.
+
+```jsonc
+{ "id": "region", "type": "select", "label": "Region",
+  "when": { "type": "equals", "left": "fields.shipping", "right": "international" } }
+```
+
+## Localized strings
+
+`label`, `title`, and `description` are localized strings. A host MUST select the rendered language by the locale-selection and fallback rules of i18n.md, and MUST treat every rendered string as untrusted: escaped for the target surface, never interpreted as markup, script, or a template directive.
+
+## Validation
+
+| Constraint | Applies to | Rule |
+| --- | --- | --- |
+| `required` | any type | the value MUST be present |
+| `format` | `text`, `longtext` | one of `email`, `uri`, `date`, `date-time`, `time`, or `x-<format>` |
+| `minLength` | `text`, `longtext` | a host MUST reject a shorter value |
+| `min`, `max` | `number` | a host MUST reject a value outside the closed range |
+| `pattern` | `text`, `longtext` | a host MUST reject a non-matching value |
+
+The five spec-reserved `format` values are the core set. A host that recognizes a format SHOULD apply it; one that does not MUST ignore it and accept plain text. A host MUST ignore `format` on any type other than `text` or `longtext`.

package/spec/v2/core/headers.md

@@ -0,0 +1,40 @@
+# Headers
+
+> **Status: Draft · v2.0.0-rc (2026-09-03) · RFC 0171 §C.1, RFC 0172 §A.3–§A.4.** GENERATED by `scripts/derive-v2-api.py` from `api/v2/openapi.yaml`; do not edit.
+
+## Why this exists
+
+RFC 0171 §C.1: every non-standard header is `OpenWOP-<Name>` and every header is declared in OpenAPI, so this table — generated from the same declaration — enumerates all of them. A header that is not in this table is not part of the protocol. Standard headers keep their standard names (`Idempotency-Key`, `ETag`, `If-None-Match`, `Last-Event-ID`, `Retry-After`, `Authorization`).
+
+## Request headers
+
+| Header | Operations | Meaning |
+| --- | --- | --- |
+| `Accept-Language` | 1 | BCP-47 preference list; authoritative for locale selection (i18n.md). A malformed value MUST NOT 400. |
+| `Idempotency-Key` | 14 | Per-mutation idempotency token (see `idempotency.md` Layer 1). |
+| `If-None-Match` | 2 | RFC 0165 §C.2; runs.md §Snapshot. Standard conditional request against any resource that carries an `ETag` — the discovery document (capabilities.md §1) and the run snapshot (runs.md §Snapshot): a matching value MUST yield `304 Not Modified` with no body, and the 304 carries `OpenWOP-Version` like every response (versioning.md §1.4). |
+| `Last-Event-ID` | 1 | Resume from sequence after this ID. |
+| `OpenWOP-Dedup` | 1 | When set, server cross-host claim system rejects duplicate `(tenantId, scopeId)` pairs with `409 Conflict`. |
+| `OpenWOP-Force-Engine-Version` | 1 | **Test-keys-only.** When set, the server emits events for this run AS IF it |
+| `OpenWOP-Version` | 51 | RFC 0172 §A.3 — selects a listed major.minor; absent ⇒ the host's `preferredVersion`; unlisted ⇒ 406 protocol_version_unsupported. |
+
+## Response headers
+
+| Header | Operations | Meaning |
+| --- | --- | --- |
+| `Cache-Control` | 2 |  |
+| `Content-Encoding` | 1 | RFC 0115. Present only when the host negotiated compression |
+| `Content-Language` | 1 | The BCP-47 locale actually used (equals the response `locale`). |
+| `ETag` | 3 | Optional probe handle for mid-session capability change detection. Deprecated toward v2 (RFC 0165 §C.2). |
+| `Location` | 1 | Canonical URI of the new template. |
+| `OpenWOP-Idempotent-Replay` | 1 | Set when the response was served from the idempotency cache. |
+| `OpenWOP-Version` | 51 | RFC 0172 §A.4 — the contract that produced this response; MUST equal the one used. |
+| `Retry-After` | 1 | Seconds until the active claim is stale-eligible. |
+
+## Webhook delivery headers
+
+Declared in `webhooks.md`, not in OpenAPI (the host is the client): `OpenWOP-Webhook-Id`, `OpenWOP-Event-Type`, `OpenWOP-Timestamp`, `OpenWOP-Signature`, `OpenWOP-Signature-Algorithm` (RFC 0165 §C.1). The `X-openwop-*` family is emitted beside them through the overlap and removed at v1 end-of-support (`spec/v1/deprecations.json` `webhook-x-header-family`).
+
+## Removed in v2
+
+`Capabilities-Etag` (the standard `ETag`/`If-None-Match` pair applies to the discovery document), `X-Dedup`, `X-Force-Engine-Version`, `X-Pack-Sha256`, `X-Pack-Signing-Method` (renamed under the one scheme), `X-openwop-*` (webhooks), `openwop-Webhook-Signature` (SDK-only). Each has a `spec/v1/deprecations.json` row with a removal trigger.

package/spec/v2/core/idempotency.md

@@ -0,0 +1,45 @@
+# Idempotency
+
+> **Status: Draft · v2.0.0-rc (2026-09-03) · RFC 0170 §D.3, RFC 0171 §B.2, RFC 0173 §B.**
+
+## Why this exists
+
+A retried request MUST NOT create a second run, and a retried node MUST NOT issue a second external effect. A host MUST implement Layer 1 for every mutating endpoint and Layer 2 for every node executor that performs an external side effect.
+
+## Layer 1: `Idempotency-Key`
+
+The header keeps its standard name (RFC 0171 §C.1) and applies to every mutating operation in `api/v2/openapi.yaml`; `GET` operations MUST NOT honor it.
+
+| Rule | Requirement |
+| --- | --- |
+| Grammar | The value MUST match `^[A-Za-z0-9._~-]{22,128}$` and MUST carry at least 128 bits of entropy (a UUIDv4 in canonical or base64url form satisfies it). A host MUST reject a value outside the grammar with `400 idempotency_key_invalid`. |
+| Record key | A record MUST be keyed by `(authenticatedTenantId, canonicalEndpointId, callerIdempotencyKey)`; the tenant MUST come from the credential, never the body. |
+| Final outcomes | A host MUST cache `2xx` and non-retryable `4xx` responses (status, headers, body) and MUST return the cached response to a same-key duplicate. |
+| Retryable outcomes | `429` and `5xx` MUST NOT be replayed from cache; a same-key retry MUST re-execute, and a later final outcome replaces the record. |
+| Not cached | `400 idempotency_key_invalid`, `400 validation_error`, `401` and `403` MUST NOT be cached. |
+| Digest mismatch | A different request digest under the same record key MUST fail with `409 idempotency_key_mismatch` and MUST NOT return the cached body. This is the only mismatch code. |
+| Concurrency | Of two concurrent same-key requests a host MUST process exactly one to completion and MUST NOT process both. Retry timing travels in `Retry-After` only. |
+| Replay marker | A response served from cache MUST carry `OpenWOP-Idempotent-Replay: true`. |
+| Retention | A record MUST be retained for at least 24 hours. |
+| Keyspace | Host-minted identifiers MUST NOT share the caller idempotency store. Logs and spans MUST NOT expose keys. |
+
+## Layer 2: effect identity
+
+Layer 2 is bound by advertising `idempotency` (security-defaults.md). Its unit is the **effect**, identified once and stable across every transport or provider retry.
+
+| Rule | Requirement |
+| --- | --- |
+| Keying | An effect MUST be keyed on its business identity (`keying: business-identity`): derived from the business operation, stable across every entry point, containing no `runId`, `nodeId` or ordinal. The activity recipe (`keying: activity-recipe`: tenant, run, node, ordinal, `providerKey`) is the fallback for a provider with no business key. |
+| Attempts | The retry counter MUST NOT participate in the identity. Two distinct logical invocations MUST receive different identities. |
+| Claim | The persist that guards the effect MUST be an atomic claim (compare-and-set or insert-if-absent) that at most one executor can win, so at most one concurrent duplicate performs the effect. |
+| Provider key | When the provider accepts an idempotency key, the host MUST inject the effect identity (or a documented deterministic derivative), stable across retries. A host that cannot use the provider's convention MUST still persist the outcome. |
+| Streaming | A streamed body MUST NOT be cached in the ledger; the host SHOULD record the request and its final outcome. |
+| Retention | An effect record MUST be retained for at least 14 days. |
+
+### Witness: `GET /runs/{runId}/effects`
+
+A host that advertises `idempotency` MUST serve `schemas/v2/effect-ledger-projection.schema.json` at `GET /runs/{runId}/effects` (`getRunEffects`): `{ runId, effects[] }`, each record carrying `effectId` (tenant-bound, `schemas/v2/ids.schema.json`), `nodeId`, `attempt`, `keying`, `state` (`claimed` | `completed` | `released` | `escaped`), `at`, optional `invocationId` and a redaction-safe `providerKey`. The projection MUST be content-free of provider payloads and credential material.
+
+## Composition
+
+Layer 1 deduplicates the caller's request; Layer 2 deduplicates the run's effects. A retried provider call inside a run MUST resolve to the same effect record. Effects under replay and fork are in replay.md; identifier grammars are in identity.md.

package/spec/v2/core/identity.md

@@ -0,0 +1,141 @@
+# Identity
+
+> **Status: Draft · v2.0.0-rc (2026-09-03) · RFC 0170, 0165, 0176.**
+
+## Why this exists
+
+v1 carried a `principal` beside an optional Subject, a legacy rule that was advisory, a `SubjectLink` with no schema, and resume tokens with no scheme. v2 makes the Subject the owner of every run, binds every lane to a trust root and a revocation rule, gives the link and every id a grammar, and prefixes tokens so a host can rotate them. Idempotency-key grammar is `idempotency.md`.
+
+## 1. The Subject is the owner (RFC 0170 §A)
+
+### 1.1 Shape (`schemas/v2/subject.schema.json`)
+
+`RunSnapshot.owner` is `{ tenant, workspace?, subject }` with `subject` REQUIRED; `principal` and `principalKind` are removed (`subject.subjectId` and `subject.kind` carry them). `run.started` MUST echo the same block (`runs.md`, `events.md`). The Subject is closed (`additionalProperties: false`):
+
+| Field | Rule |
+| --- | --- |
+| `issuer` | REQUIRED; the lane's trust root (§2.2); `^\S+$`, 1–1024 |
+| `subjectId` | REQUIRED; `ids.schema.json#/$defs/subjectId` — issuer-scoped, stable, opaque, never PII |
+| `tenant` | REQUIRED; `tenantId` |
+| `lane` | REQUIRED; `api-key \| oauth2 \| oidc \| mtls \| saml \| scim \| ldap \| workload \| session \| anonymous` |
+| `kind` | REQUIRED; `user \| agent \| anonymous \| workload` |
+| `keyClass` | `opaque-idp \| configured-immutable`; MUST be present iff `lane ∈ {saml, scim}` |
+| `actor` | OPTIONAL; a nested Subject that acts on this subject's behalf; depth bounded at four |
+
+`kind: anonymous` REQUIRES `lane: anonymous` and `lane: anonymous` REQUIRES `kind: anonymous`. The `actor` depth bound (4) is a four-level `$ref` chain (`actor1`…`actor4`) rather than a recursive `$ref`; a fifth level MUST fail validation. `session` is a host-native credential the host itself issued (a durable login session, a local password); `anonymous` is an RFC 0132 public surface. The lane enum grows only under `overview.md` §0.
+
+### 1.2 The legacy subject rule (RFC 0170 §A.3)
+
+On every read of a run created before the host began emitting subjects, the host MUST stamp `issuer: "urn:openwop:legacy"`, `lane` as attested else `api-key`, `kind` as recorded else `user`. A host MUST stamp the legacy subject at first read and MUST NOT rewrite it later. A legacy subject MUST NOT participate in a link (§3), an actor chain, or a delegation decision.
+
+### 1.3 Fork (RFC 0170 §A.4)
+
+On fork the host MUST copy `owner` verbatim onto the child: `tenant`, `workspace`, and `subject`. There is no `principal` asymmetry.
+
+### 1.4 A2A anonymous end users (RFC 0170 §A.5)
+
+An end user reaching the host through an A2A peer is `kind: anonymous`, `lane: anonymous`, with the forwarding peer's subject as `actor`; such a subject MUST NOT be linked.
+
+## 2. One binding pipeline, every lane (RFC 0170 §B)
+
+### 2.1 The pipeline (§B.1)
+
+Every lane MUST: verify the credential against the lane's trust root; bind the verified identity to the request, never to an asserted header; check audience; resolve to a Subject before any authorization decision; and fail closed. The closed reason vocabulary is the family-wide error set in §6. Every lane is advertised as one member of the `auth.lanes[]` facet (`spec/v2/facets/auth.schema.json`):
+
+```json
+{ "lane": "oidc", "issuers": ["https://idp.example"], "revocation": "exp-and-recheck",
+  "revocationWindowSeconds": 300, "minimumAssurance": "sender-constrained",
+  "delegationProofs": ["dpop"] }
+```
+
+`lane`, `issuers[]` (min 1), `revocation`, and `minimumAssurance` are REQUIRED on each member. `auth.lanes[].issuers[]` is the realm; the v1 `auth.profiles` facet is replaced by it (`capabilities.md`).
+
+### 2.2 Trust roots and revocation (§B.2, §B.3)
+
+Every lane MUST name its trust root as `subject.issuer` and MUST advertise it in `issuers[]`. Revocation exists for every lane; the `revocation` value names the rule.
+
+| Lane | `subject.issuer` (trust root) | Revocation MUST | `revocation` |
+| --- | --- | --- | --- |
+| `api-key` | the key realm (`urn:<host>:api-key` or a host-chosen URI) | refuse a revoked key on the next request (`credential_revoked`) | `next-request` |
+| `oauth2` | the token issuer | honor `exp`; re-check the issuer within the advertised `revocationWindowSeconds` | `exp-and-recheck` |
+| `oidc` | `iss` | as `oauth2` | `exp-and-recheck` |
+| `mtls` | the CA subject | check CRL or OCSP, or issue certificates whose lifetime is at most the advertised window | `crl \| ocsp \| short-lived` |
+| `saml` | the IdP entityID (`<saml:Issuer>`) | honor `NotOnOrAfter`; consult the SCIM link deny-set when both lanes are advertised (§3) | `not-on-or-after` |
+| `scim` | the SCIM connection id bound at configuration to one IdP entityID | bind each client credential to one IdP entityID; refuse an unbound request | `bound-connection` |
+| `ldap` | the directory base DN | re-bind on each request or advertise a session window | `rebind` |
+| `workload` | the scheme's trust root | enforce `delegation_expired` | `delegation-expiry` |
+| `session` | `urn:<host>:session` | refuse a revoked session on the next request (`credential_revoked`) | `next-request` |
+| `anonymous` | `urn:<host>:anon-surface` | — | — |
+
+`revocationWindowSeconds` (integer ≥ 1) MUST be advertised wherever the rule names a window (`exp-and-recheck`, `short-lived`, `rebind`).
+
+### 2.3 Minimum assurance (§B.4)
+
+Each lane MUST advertise `minimumAssurance: bearer | sender-constrained | key-bound`. A request below the lane's floor MUST be refused with `sender_constraint_missing`. An audit fact MUST record the assurance actually used. A bearer fallback MUST NOT inherit a sender-constrained label (invariant `sender-constraint-no-bearer-downgrade`, `SECURITY/invariants.yaml`).
+
+### 2.4 Delegation proofs (§B.5)
+
+The proof format is lane-scoped: mTLS key binding or DPoP for the two JWT lanes (`oauth2`, `oidc`), SVID chains for `workload`. A host MUST advertise the proofs it accepts under `auth.lanes[].delegationProofs[]` (`mtls-key-binding | dpop | svid-chain`). A chain with no acceptable proof MUST be refused as `identity_unverified`. The chain rules keep their codes: a chain longer than the bound is `delegation_chain_too_long`, a cyclic chain is `delegation_chain_cyclic`, and a link that widens scope is `delegation_scope_amplified` (invariants `delegation-chain-bounded-acyclic`, `delegation-no-scope-amplification`, `delegation-provenance-not-authorization`).
+
+## 3. The link is a record (RFC 0170 §C; `schemas/v2/subject-link.schema.json`)
+
+```json
+{ "a": { "issuer": "…", "subjectId": "…" }, "b": { "issuer": "…", "subjectId": "…" },
+  "keyClass": "opaque-idp" | "configured-immutable", "issuer": "<IdP entityID>",
+  "tenant": "<tenantId>", "formedAt": "<date-time>", "deniedAt"?: "<date-time>" }
+```
+
+The record and both `SubjectRef`s are closed; `a`, `b`, `keyClass`, `issuer`, `tenant`, `formedAt` are REQUIRED. A link MUST be tenant-scoped, MUST join exactly two subjects whose `issuer` values are bound to one IdP entityID (`issuer` on the record), and MUST NOT include a legacy (`urn:openwop:legacy` is schema-rejected) or anonymous subject. Deactivation sets `deniedAt`; the SAML decision path MUST consult it (the leaver contract). The link is a reference, not a merge: nothing rewrites a subject already stamped on a run.
+
+`auth.subjectLinking` is removed (`capabilities.md` row `C2.5`): advertising both `saml` and `scim` lanes implies the contract. Lanes stay separate facets; there is no single "enterprise identity" profile. The `auth.subjectLinkKey` facet (`opaque-idp | configured-immutable`) names the key class the host forms links under. Invariant `subject-link-record-shape` is registered with its scenario.
+
+## 4. Resume tokens (RFC 0170 §E.1; RFC 0176 §B.2)
+
+An interrupt resume token is `ow2.<alg>.<kid>.<payload>.<mac>`: `alg ∈ {hs256}` at the cut (`interrupt.tokenAlgs[]` advertises it), `kid` (`keyId` grammar) selects the verification secret, `payload` and `mac` as in v1. A host MUST refuse a token whose `alg` it does not advertise or whose `kid` it does not hold with `401` `interrupt_token_invalid`. The `{token}` path parameter carries the grammar (`api/v2/openapi.yaml`).
+
+An issued v1 two-segment token MUST remain resolvable under `kid: legacy` until its `expiresAt`; a run suspended on an interrupt at the cut continues under `persistence.md` and its outstanding token resolves the same way. Interrupt semantics are `interrupt.md`.
+
+## 5. Identifier grammars (`schemas/v2/ids.schema.json`)
+
+Every id field in every v2 schema and every `api/v2/openapi.yaml` parameter and response body MUST `$ref` its kind. `x-openwop-minted` records who mints the id: `host` (opaque and checkable), `author` (chosen in a workflow or pack; the v1 grammar stands), or `registry`.
+
+| Kinds | Grammar | Minted |
+| --- | --- | --- |
+| `runId`, `interruptId`, `subscriptionId`, `deliveryId`, `effectId` | tenant-bound `<tenantId>/<opaque>`: `^[A-Za-z0-9._~-]{1,128}/[A-Za-z0-9._~-]{16,128}$` | host |
+| `eventId` | `^[A-Za-z0-9._~-]{16,128}$` | host |
+| `tenantId`, `workspaceId` | `^[A-Za-z0-9._~-]{1,128}$` | host |
+| `subjectId` | `^[^\s/]{1,256}$` (the issuer's grammar) | host |
+| `traceId`, `spanId` | W3C `^[0-9a-f]{32}$`, `^[0-9a-f]{16}$` | host |
+| `keyId` | `^[A-Za-z0-9._~-]{1,128}$` (signing keys, resume-token `kid`, bundle signatures) | registry |
+| `nodeId`, `workflowId`, `agentId`, `chainId`, `pluginId`, `templateId`, `libraryId` | `^[A-Za-z0-9._~:-]{1,128}$` | author |
+| `typeId` | `^[a-z][a-z0-9-]*(\.[a-z][a-zA-Z0-9-]*)+$` | author |
+
+This obligation is enforced by `scripts/check-id-kinds-bound.mjs` against `spec/v2/id-field-bindings.json`, which places every `*Id` property in a v2 schema into one of two sets: it **is** one of the kinds above (and MUST `$ref` it), or nothing here governs it (with the reason recorded). A property in neither **fails**, so a new id field cannot be added without someone deciding which it is. The map exists rather than a name-matching rule because only 20 of the 88 `*Id` properties share a name with a kind: `childRunId` sat as `{type: string, minLength: 1}` in the same file where `parentRunId` was correctly bound, and a check keyed on names would have reported green over it. The rule above says *every id field*, not *every field whose name matches*.
+
+The `typeId` grammar admits `_` because `node-pack-manifest.schema.json`'s `name` pattern does and a pack's node type ids are derived from its name — a pack legally named `vendor.acme.my_tools` MUST be able to declare `vendor.acme.my_tools.echo`. A kind that rejects an id a legal name generates is a constraint that cannot express a legitimate value.
+
+A host MUST reject a tenant-bound id whose tenant segment is not the caller's with `403` `id_tenant_mismatch`. A host-minted opaque segment MUST match `^[A-Za-z0-9._~-]{16,128}$`: no `@`, no whitespace, no `/`. Handle grammars (`memoryRef`, workspace `path`/`etag`, the plugin version token) and their `resolvability` class are specified where each handle is used; an importer MUST re-mint every `host`-scoped handle (`spec/v2/ext/portability/`).
+
+## 6. Identity error codes (`spec/v2/errors.json`)
+
+Every code below is a row with `since: "2.0"`, `retriable: false`, and no `details` contract; the envelope is `errors.md`.
+
+| Code | HTTP | Raised when |
+| --- | --- | --- |
+| `identity_unverified` | 401 | the credential fails verification against the lane's trust root, or a delegation chain has no acceptable proof |
+| `identity_unresolvable` | 401 | a verified identity resolves to no Subject |
+| `audience_mismatch` | 401 | the credential's audience is not this host |
+| `credential_revoked` | 401 | a revoked key or session is presented (§2.2) |
+| `delegation_expired` | 401 | a delegation or workload credential is past its lifetime |
+| `sender_constraint_missing` | 401 | the request is below the lane's `minimumAssurance` (§2.3) |
+| `delegation_chain_too_long` | 400 | the actor chain exceeds depth 4 |
+| `delegation_chain_cyclic` | 400 | the actor chain repeats a subject |
+| `delegation_scope_amplified` | 403 | a delegated link claims more scope than its delegator |
+| `id_tenant_mismatch` | 403 | a tenant-bound id's tenant segment is not the caller's (§5) |
+| `interrupt_token_invalid` | 401 | an unadvertised `alg` or an unheld `kid` (§4) |
+
+`unauthenticated` and `run_forbidden` keep their v1 rows. Every code is a registry member under `overview.md` §0.
+
+## 7. Invariants (RFC 0170 §E.2)
+
+`workload-identity-cryptographically-bound`, `delegation-provenance-not-authorization`, `delegation-no-scope-amplification`, `delegation-chain-bounded-acyclic`, `sender-constraint-no-bearer-downgrade`, `provenance-attestation-digest-bound`, `subject-link-record-shape`, and `subject-required-on-owner` are registered in `SECURITY/invariants.yaml` with their scenarios; an invariant that reaches the cut without a witness is demoted from `protocol` tier and recorded.